This report is not translated for the requested language. The canonical English report is shown instead.
Versioned security assessment
Report ID: SA-3E4B6C31
7/9/2026, 7:37:53 AM
infsh-cli security assessment v3
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- infsh-cli
- Version
- v3
- Maintainer
- halt-catch-fire
- Coverage
- 5 Files scanned · 608 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
7 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The skill is a community CLI integration that intentionally runs external commands and contacts inference.sh services. The remote installer uses curl piped to sh in multiple files, and local file upload plus Twitter/X automation create high-impact side effects that require explicit user confirmation.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
5 Files scanned · 608 Lines analyzed
34 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 17 evidence locations
Filesystem access
May read or write local files.
Observed in 3 evidence locations
Env variables
May read values from the process environment.
Observed in 3 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 21 evidence locations
Capability review items (27)
Critical
Ruby/shell backtick execution
```bash
The fenced shell block includes curl piped to sh followed by login. The installer step executes remotely downloaded code before local inspection.
High
Ruby/shell backtick execution
> ```bash
The manual install block downloads remote assets, parses a remote manifest, verifies checksums, extracts an archive, and moves an executable into PATH. This is a legitimate install flow but has supply-chain and local persistence risk.
High
Ruby/shell backtick execution
```bash
These commands run belt with local media paths that are automatically uploaded to external apps, and one example posts media to X/Twitter. That creates data disclosure and account-action risk.
High
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command builds a download URL from a remote manifest using shell command substitution. Even in documentation, this dynamic install pattern is risky and hard to audit.
High
Template literal with command substitution
> ```bash
The manual install block contains dynamic command substitution inside a remote download flow. This makes the installer path less transparent and increases supply-chain risk.
High
Hidden file in home directory
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The manual install flow moves a downloaded executable into ~/.local/bin, placing persistent code in the user PATH. It is user-directed but has real local persistence impact.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The line instructs users to install another skill through npx, which performs a network package operation. This is legitimate setup guidance but carries supply-chain risk.
Medium
Ruby/shell backtick execution
```bash
The quick examples run hosted apps through belt, including web search and Twitter posting. These external CLI actions can create network and account side effects.
Medium
Ruby/shell backtick execution
```
The range transitions into a command table and includes a remote app-store operation. The pattern is broad, but it does point to external CLI activity.
Medium
Ruby/shell backtick execution
| Browse the app store | `belt app store` |
The belt app store command queries the public app store over the network. There is no injection evidence, but it is still external command execution.
Medium
Ruby/shell backtick execution
| Search the store | `belt app store search "flux"` |
The store search command sends a user query to the external service. This is intended behavior, but it is a real networked CLI operation.
Medium
Ruby/shell backtick execution
| Filter by category | `belt app store --category image` |
Filtering the remote app store still invokes the external belt CLI service. The risk is limited but the command has network side effects.
Medium
Ruby/shell backtick execution
| List your apps | `belt app list` |
Listing user apps queries account-specific remote data through belt. This can expose workspace metadata to the agent and terminal output.
Medium
Ruby/shell backtick execution
| Get app details | `belt app get google/veo-3-1-fast` |
Getting app details calls the external service for app metadata and schemas. It is expected functionality but remains a networked CLI action.
Medium
Ruby/shell backtick execution
| Generate sample input | `belt app sample google/veo-3-1-fast --save input.json` |
Generating a sample input can fetch app schema data and write an input file locally. This is legitimate but still an external command with filesystem effects.
Medium
Ruby/shell backtick execution
| Run app | `belt app run google/veo-3-1-fast --input input.json` |
Running an app submits user-provided inputs to a hosted service. This is the core feature, but it can transmit data and incur external side effects.
Medium
Ruby/shell backtick execution
| Run without waiting | `belt app run <app> --input input.json --no-wait` |
Running without waiting submits a background task to the hosted service. This can transmit data and consume account resources asynchronously.
Medium
Ruby/shell backtick execution
| Check task status | `belt task get <task-id>` |
Checking task status retrieves remote task data and results through the external CLI. It is intended, but it remains account-scoped external command execution.
Medium
Ruby/shell backtick execution
```bash
The related skills block uses npx commands to install multiple additional remote skills. That expands the trusted code surface and introduces package supply-chain risk.
Medium
Hidden file access
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The same install flow writes into a hidden home-directory path. This is normal for user binaries, but it still modifies persistent executable search paths.
Low
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL is used in a curl pipeline to a shell installer, so it drives network download for executable code. The hardcoded domain is expected for setup but still creates remote code supply-chain risk.
Low
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL is used in a reinstall command that pipes a remote script to the shell. This is an expected installer endpoint, but it is still executable network content.
Low
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The hardcoded URL appears inside the CLI installation command that executes remote content. It is legitimate setup documentation but still a network execution dependency.
Low
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL is used in the curl-to-shell install command. The endpoint is expected, but it directly supplies executable installer content.
Low
Hardcoded URL
> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and
The link points to the install script discussed by the setup instructions. It is not execution by itself, but it supports the remote installer flow.
Low
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The command downloads checksums from a hardcoded distribution endpoint during manual install. This is legitimate verification support but still an external install dependency.
Low
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command fetches a remote manifest to select an installer artifact. This is an external dependency in an installation flow.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (7)
RISK-001 Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command downloads a remote script and executes it immediately with sh. Users and agents cannot inspect or pin the installer before execution.
RISK-002 Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall path repeats the same curl-to-shell installer pattern. This remains a critical supply-chain execution risk even if the endpoint is legitimate.
RISK-003 Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The CLI reference repeats the curl-to-shell installer. Direct execution of remote installer code is a critical supply-chain pattern.
RISK-004 Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The primary install instruction pipes a remote script directly to sh. This is a critical remote-code execution and supply-chain pattern.
RISK-005 High
Automatic Local File Uploads to External Apps
The skill tells agents that the CLI automatically uploads local paths when supplied as inputs. This can disclose private files if a model selects paths without explicit user approval.
Both cited sections explicitly describe automatic uploads of local paths and show absolute, relative, and home-directory examples. The risk depends on user approval, but the capability is clearly documented.
RISK-006 High
Social Media Account Actions
The skill includes Twitter/X posting, media posting, direct message, follow, like, and retweet workflows. These actions can affect external accounts and require explicit user confirmation.
The skill names concrete Twitter/X commands for posting and related account interactions. These are intentional capabilities, not just pattern matches.
RISK-007 High
Broad Belt Command Permission
The skill grants Bash access to all belt subcommands, while the reference includes deployment and source-pull operations. This broad permission expands the blast radius beyond simple app execution.
The allowed-tools entry permits belt with any arguments, and the CLI reference documents development commands such as deploy and pull. The exact account impact depends on credentials, so confidence is high but not absolute.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalRemote installer is executed through curl piped directly to sh.Replace pipe-to-shell instructions with version-pinned package manager or release downloads verified before execution.
- FIX-002HighManual install command builds a download URL from a remote manifest using shell command substitution.Provide explicit platform-specific download commands or a signed package manager flow without dynamic shell parsing.
- FIX-003HighThe skill can upload local files to hosted apps when paths are supplied as inputs.Require explicit user confirmation before running any command that references local files or parent-directory paths.
- FIX-004HighTwitter/X actions can post, message, follow, like, or retweet from a connected account.Require a user-approved final preview before any social media action or account-changing command is executed.
- FIX-005MediumThe tool permission allows all belt subcommands.Narrow allowed commands to the minimum app discovery and task execution subcommands needed by this skill.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable